reason:
1. g_running_tasks = thread A
2. thread A exit (free thread A's tcb) -> thread B
3. thread B interrupt by irq
4. check g_running_tasks->flags -> kasan report used after free
rootcause:
g_running_tasks has't set completely when syscall hanppened
Resolve:
Use rtcb (get at ISR begining) instead
Signed-off-by: ligd <liguiding1@xiaomi.com>
There one ways can caused this:
mq_timedreceive
TIMER IRQ do wd_timer -> wd_func1 mq_send
-> wd_func2 nxmq_rcvtimeout -> crash
Resolve:
Stop the watchdog when mq_send
Signed-off-by: ligd <liguiding1@xiaomi.com>
it inappropriate to apply volatile to the task list:
1.The code access task list is already protected by critical section
2.The queue is complex struct, it isn't enough to protect by volatile
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
because not all compiler support the weak attribute, and
many features are either always used or guarded by config.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
strlcpy ensure the destination is NUL-terminated, and also fix warning:
```c
task/task_prctl.c:138:15: warning: 'strncpy' output may be truncated copying 30 bytes from a string of length 31 [-Wstringop-truncation]
138 | strncpy(name, tcb->name, CONFIG_TASK_NAME_SIZE - 1);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
Signed-off-by: Huang Qi <huangqi3@xiaomi.com>
1.Forward nxsched_process_cpuload to nxsched_process_cpuload_ticks directly
2.Define the dummy nxsched_process_cpuload_ticks when CPULOAD isn't enabled
3.Remove the weak attribute from nxsched_process_cpuload_ticks
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
D:\code\incubator-nuttx\sched\pthread\pthread_create.c(154,22):
warning C4189: “pjoin”: local variable is initialized but not referenced
[D:\code\incubator-nuttx\vs20221\sched\sched.vcxproj]
D:\code\incubator-nuttx\sched\group\group_setupidlefiles.c(61,28):
warning C4189: “group”: local variable is initialized but not referenced
[D:\code\incubator-nuttx\vs20221\sched\sched.vcxproj]
Reference:
https://docs.microsoft.com/en-us/cpp/error-messages/compiler-warnings/compiler-warning-level-4-c4189?view=msvc-170
Signed-off-by: chao.an <anchao@xiaomi.com>
and remove CONFIG_LIBC_LONG_LONG option to simplify the usage.
note: the size will increase 668
before change:
text data bss dec hex filename
168440 348 4480 173268 2a4d4 nuttx
after change:
text data bss dec hex filename
169108 348 4480 173936 2a770 nuttx
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
clock/clock_settime.c: In function ‘clock_settime’:
clock/clock_settime.c:120:45: warning: passing argument 1 of ‘clock_timekeeping_set_wall_time’
discards ‘const’ qualifier from pointer target type [-Wdiscarded-qualifiers]
120 | ret = clock_timekeeping_set_wall_time(tp);
| ^~
In file included from clock/clock_settime.c:37:
sched/clock/clock_timekeeping.h:40:58: note: expected ‘struct timespec *’
but argument is of type ‘const struct timespec *’
40 | int clock_timekeeping_set_wall_time(FAR struct timespec *ts);
|
Signed-off-by: chao.an <anchao@xiaomi.com>
The "p" format specifier already prepends the pointer address with
"0x" when printing.
Signed-off-by: Gustavo Henrique Nihei <gustavo.nihei@espressif.com>
since _exit may kill all sibling thread when
HAVE_GROUP_MEMBERS equal true. Regressed by:
commit 622677d4a1
Author: Ville Juven <ville.juven@unikie.com>
Date: Mon May 2 15:15:06 2022 +0300
libc: Implement exit, atexit, on_exit and cxa_exit on the user side
For CONFIG_BUILD_KERNEL using the sched/task/task_exithook implementation
will just not work. It calls user code with kernel privileges which is
a bit of a security issue.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
For CONFIG_BUILD_KERNEL using the sched/task/task_exithook implementation
will just not work. It calls user code with kernel privileges which is
a bit of a security issue.
pthread_condclockwait() can not distinguish between interrupt and timeout,
which cause these API not follow POSIX:
pthread_rwlock_timedrdlock()
pthread_rwlock_timedwrlock()
pthread_condtimedwait()
POSIX:
Upon return from the signal handler the thread resumes waiting for
the condition variable as if it wasnot interrupted
These functions shall not return an error code of [EINTR].
Replacing nxsem_wait() with nxsem_clockwait_uninterruptible() can solve it.
Signed-off-by: jihandong <jihandong@xiaomi.com>
Deleting a task from another task's context will not do, so shut
this gate down for BUILD_KERNEL. In this case if a task wants another
task to terminate, it must ask the other task to politely kill itself.
Note: kthreads still need this, also, the kernel can delete a task
without asking.
1. fix typo spilock -> spinlock
2. fix build break
sched/sched_note.c: In function ‘note_spincommon’:
sched/sched_note.c:435:3: error: aggregate value used where an integer was expected
435 | note.nsp_value = (uint8_t)*spinlock;
| ^~~~
Signed-off-by: chao.an <anchao@xiaomi.com>
Summary:
- In case of SMP and ADDRENV, allocate current group for each cpu
- g_pid_current holds pid of the group and uses for addrenv switching
- allocate g_group_current for each cpu in stead of g_pid_current
- g_group_current is the array that pointed to the current task_group_s struct
Impact:
- ADDRENV=y and SMP=y
Testing:
- sabre-6quad:smp w/ qemu
- sabre-6quad:knsh w/ qemu
- sabre-6quad:knsh_smp w/ qemu (WIP)
Signed-off-by: Oki Minabe <minabe.oki@gmail.com>
If address environments are in use, it is not possible to simply
memcpy from from one process to another. The current implementation
of env_dup does precisely this and thus, it fails at once when it is
attempted between two user processes.
The solution is to use the kernel's heap as an intermediate buffer.
This is a simple, effective and common way to do a fork().
Obviously this is not needed for kernel processes.
if a pthread set attr is detach,and when call pthread_create,
new thread exit quikly,new thread's tcb be free,then pthread_create
use new thread's tcb will crash.
Signed-off-by: anjiahao <anjiahao@xiaomi.com>
pthread_join need check thread is DETACHED,
Whether to wait according to the result.And,
if a thread is DETACHED,it will not set a new
attr.
Signed-off-by: anjiahao <anjiahao@xiaomi.com>
The implementation of this feature is based on android systrace:
https://source.android.com/devices/tech/debug/ftrace
Application developers are more concerned about the performance of
the specified application section,
added two APIs to implement performance measurement:
void sched_note_begin(uintptr_t ip, FAR const char *buf);
void sched_note_end(uintptr_t ip, FAR const char *buf);
or
SCHED_NOTE_BEGIN(); /* defined to sched_note_begin(_THIS_IP_, __FUNCTION__) */
SCHED_NOTE_END(); /* defined to sched_note_end(_THIS_IP_, __FUNCTION__) */
Signed-off-by: chao.an <anchao@xiaomi.com>
When the initial proxy task is duplicated into the first user task,
the environment exists in kernel memory and this must be copied to user
memory.
The memory allocated for the new task was allocated with the parent's
priority which is incorrect. Use the new task's priority instead.
Follow-up for: #5753
- User mode allocator was used for setting up the environment. This
works in flat mode and probably in protected mode as well, as there
is always a a single user allocator present
- This does not work in kernel mode, where each user task has its own
heap allocator. Also, when the idle tasks environment is being set,
no allocator is ready and the system crashes at once.
Fix this by using the group allocators instead:
- Idle task is a kernel task, so its group is privileged
- Add group_realloc
- Use the group_malloc/realloc functions instead of kumm_malloc
Error: module/mod_insmod.c:203:3: error: 'strncpy' specified bound 16 equals destination size [-Werror=stringop-truncation]
203 | strncpy(modp->modname, modname, MODLIB_NAMEMAX);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
wqueue/kwork_thread.c: In function 'work_start_lowpri':
Error: wqueue/kwork_thread.c:212:22: error: '%lx' directive output may be truncated writing between 1 and 16 bytes into a region of size 14 [-Werror=format-truncation=]
212 | snprintf(args, 16, "0x%" PRIxPTR, (uintptr_t)wqueue);
local/local_sockif.c: In function 'local_getsockname':
Error: local/local_sockif.c:392:11: error: 'strncpy' specified bound depends on the length of the source argument [-Werror=stringop-overflow=]
392 | strncpy(unaddr->sun_path, conn->lc_path, namelen);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
chip/esp32_wifi_utils.c: In function 'esp_wifi_scan_event_parse':
Error: chip/esp32_wifi_utils.c:373:37: error: argument to 'sizeof' in 'memset' call is the same expression as the destination; did you mean to dereference it? [-Werror=sizeof-pointer-memaccess]
memset(ap_list_buffer, 0x0, sizeof(ap_list_buffer));
^
stdio/lib_fputs.c: In function 'fputs':
Error: stdio/lib_fputs.c:99:9: error: nonnull argument 's' compared to NULL [-Werror=nonnull-compare]
if (s == NULL || stream == NULL)
^
Error: stdio/lib_fputs.c:99:27: error: nonnull argument 'stream' compared to NULL [-Werror=nonnull-compare]
if (s == NULL || stream == NULL)
^
stdio/lib_vfprintf.c: In function 'vfprintf':
Error: stdio/lib_vfprintf.c:40:6: error: nonnull argument 'stream' compared to NULL [-Werror=nonnull-compare]
if (stream)
^
string/lib_strdup.c: In function 'strdup':
Error: string/lib_strdup.c:39:6: error: nonnull argument 's' compared to NULL [-Werror=nonnull-compare]
if (s)
^
string/lib_strndup.c: In function 'strndup':
Error: string/lib_strndup.c:56:6: error: nonnull argument 's' compared to NULL [-Werror=nonnull-compare]
if (s)
^
string/lib_strpbrk.c: In function 'strpbrk':
Error: string/lib_strpbrk.c:39:7: error: nonnull argument 'str' compared to NULL [-Werror=nonnull-compare]
if (!str || !charset)
^~~~
Error: string/lib_strpbrk.c:39:15: error: nonnull argument 'charset' compared to NULL [-Werror=nonnull-compare]
if (!str || !charset)
^~~~~~~~
string/lib_strrchr.c: In function 'strrchr':
Error: string/lib_strrchr.c:40:6: error: nonnull argument 's' compared to NULL [-Werror=nonnull-compare]
if (s)
^
Error: time/lib_asctimer.c:73:50: error: '%d' directive output may be truncated writing between 1 and 11 bytes into a region of size between 0 and 12 [-Werror=format-truncation=]
snprintf(buf, 26, "%.3s %.3s%3d %.2d:%.2d:%.2d %d\n",
^~
time/lib_asctimer.c:73:21: note: directive argument in the range [-2147481748, 2147483647]
snprintf(buf, 26, "%.3s %.3s%3d %.2d:%.2d:%.2d %d\n",
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
time/lib_asctimer.c:73:3: note: 'snprintf' output between 17 and 68 bytes into a destination of size 26
snprintf(buf, 26, "%.3s %.3s%3d %.2d:%.2d:%.2d %d\n",
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
g_wday_name[tp->tm_wday], g_mon_name[tp->tm_mon],
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tp->tm_mday, tp->tm_hour, tp->tm_min, tp->tm_sec,
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1900 + tp->tm_year);
~~~~~~~~~~~~~~~~~~~
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
since the temporary kernel spawn proxy need duplicate file handler
from caller, please reference the follow source code for more info:
sched/task/task_posixspawn.c
sched/task/task_spawn.c
This reverts commit 5c5f1dec08.
Summary:
- I noticed that exiting task or pthread causes dataabort if ARCH_ADDRENV=y
- This commit fixes this issue by switching the addrenv correctly
Impact:
- CONFIG_ARCH_ADDRENV=y only
Testing:
- Tested with sabre-6quad:netknsh (not merged yet)
Signed-off-by: Masayuki Ishikawa <Masayuki.Ishikawa@jp.sony.com>
here is the reason:
1.clock_systime_timespec(core function) always exist regardless the setting
2.CLOCK_MONOTONIC is a foundamental clock type required by many places
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
State of problem:
- Some drivers that do not support write operations (does not
have write handler or ioctl do not perform any write actions)
are registered with write permissions
- Some drivers that do not support read operation (does not
have read handler or ioctl do not perform any read actions)
are registered with read permissions
- Some drivers are registered with execute permissions
Solution:
- Iterate code where register_driver() is used and change 'mode'
parameter to reflect the actual read/write operations executed
by a driver
- Remove execute permissions from 'mode' parameter
Signed-off-by: Petro Karashchenko <petro.karashchenko@gmail.com>
1. The task which called nxsem_release_holder may not be a holder of the semaphore,
counts of the holder would not be decreamented.
This commit try to resolve the problem if there is only one holder.
2. Avoid counts overflow.
Signed-off-by: Zeng Zhaoxiu <walker.zeng@transtekcorp.com>
Add a list in TCB to track all semphores the task held, so we
can release all holders when exit, so nxsched_verify_tcb
is unnecessary.
Signed-off-by: Zeng Zhaoxiu <walker.zeng@transtekcorp.com>
Add a comment briefly explaining why one timer tick is added to the watchdog delay. This has confused a lot of people and has resulted in numerous awkward discussions and ill-informed attempts to modify the code to remove that addition. Perhaps a rather lengthy comment will reduce that confusion and put an end to this thrashing.
should be removed by:
commit fca07be1df
Author: Gregory Nutt <gnutt@nuttx.org>
Date: Tue Oct 10 08:43:10 2017 -0600
Squashed commit of the following:
Change all calls to mq_send() and mq_timedsend() in the OS to calls to
nxmq_send() and nxmq_timedsend(), making appropriate changes for differences
in return values.
sched/mqueue: Add internal function nxmq_send() and nxmq_timedsend() that are
equivalent to mq_send() and mq_timedsend() except that they do not create
cancellation points and do to not modify the errno variable.
Signed-off-by: chao.an <anchao@xiaomi.com>
since the related code was removed by:
commit 4d5a964f29
Author: Jiuzhu Dong <dongjiuzhu1@xiaomi.com>
Date: Tue Feb 23 18:04:13 2021 +0800
net: unify socket into file descriptor
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Perf timer interface generally uses the hardware cycle counter
provided by the arch chip directly(such as DWT_CYCCNT(cortex-m)),
CYCCNT is a free running counter and counting upwards.
It wraps around to 0 on overflow.
Signed-off-by: chao.an <anchao@xiaomi.com>
For example, task is blocked by nxsem_wait(sem1), use nxsem_wait(sem2)
in signal handler, and take sem2 successfully, after exit from signal
handler to task, nxsem_wait(sem1) returns OK, but the correct result
should be -EINTR.
Signed-off-by: Zeng Zhaoxiu <zhaoxiu.zeng@gmail.com>
The BUG is as follow:
1. Suppose there are two ready tasks t1 and t2 have the same priority, and t1 is the running.
2. A new, higher priority task t0 (such as hpwork) is ready, then switch to t0.
3. After t0 is suspended, then switch to t1 and reset the t1's timeslice.
4. goto 2
The t2 will have no chance to run.
Signed-off-by: Zeng Zhaoxiu <zhaoxiu.zeng@gmail.com>
1. If CONFIG_SCHED_INSTRUMENTATION_SWITCH is enabled, then these additional interfaces are expected:
sched_note_suspend
sched_note_resume
at the same time，If CONFIG_SMP is enabled，then expected：
sched_note_cpu_pause
sched_note_cpu_paused
sched_note_cpu_resume
sched_note_cpu_resumed
2. other board if enable SCHED_INSTRUMENTATION，SCHED_INSTRUMENTATION_SWITCH to defconfig.
There is a potential problem that can lead to deadlock at
condition wait, if the timeout of watchdog is a very small value
(1 tick ?), the timer interrupt will come before the nxsem_wait()
Revert "sched: pthread: Remove a redundant critical section in pthread_condclockwsait.c"
Revert "sched: semaphore: Remove a redundant critical section in nxsem_clockwait()"
Revert "sched: semaphore: Remove a redundant critical section in nxsem_tickwait()"
This reverts commit 7758f3dcb1.
This reverts commit 2976bb212e.
This reverts commit 65dec5d10a.
Signed-off-by: chao.an <anchao@xiaomi.com>
argv is allocated from stack and then belong to userspace,
so task_info_s is a best location to hold this information.
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Summary:
- This commit introduces a private spinlock in sig_action.c
Impact:
- None
Testing:
- Tested with spresense:wifi_smp and spresense:wifi
Signed-off-by: Masayuki Ishikawa <Masayuki.Ishikawa@jp.sony.com>
If a task registers SIGCHLD, uses waitpid(-1)
in the handler, and the task also calls waitpid,
it will fail to delete the child function
Signed-off-by: anjiahao <anjiahao@xiaomi.com>
In scene with CONFIG_SCHED_TICKLESS but no CONFIG_SCHED_TICKLESS_ALARM
The system may crash by assert
`up_assert: Assertion failed at file:wdog/wd_start.c line: 379 task: rptun`
Signed-off-by: zhuyanlin <zhuyanlin1@xiaomi.com>
Fix the regression by commit:
commit 8b67944c75
Author: Xiang Xiao <xiaoxiang@xiaomi.com>
Date: Thu Oct 14 11:03:07 2021 +0800
sched: Remove pidhash_s and move ticks to tcb_s
simplify the code logic and reduce memory a little bit
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
when enable SYSTEM_TIME64, tick may exceed the int32 range
example:
pthread_cond_clockwait
---->clock_abstime2ticks
---->wd_start
Signed-off-by: Jiuzhu Dong <dongjiuzhu1@xiaomi.com>
the logical may choose the head of g_readytorun(the greatest priority)
task as the next while ignoring the cpu affinity of it.
Signed-off-by: chenhonglin <chenhonglin@xiaomi.com>
In "nxsched_nexttcb": the task may not running on this_cpu,
and rtrtcb->affinity(the affinity of the task in g_readytorun)
may not include the current cpu which should be the tcb->cpu.
Signed-off-by: chenhonglin <chenhonglin@xiaomi.com>
If statement in line 103 could acces wdactivelist.head->lag when head was
NULL which could result in hard fault. The statement was also redundant
as the same condition is checked in the while loop below. This change
remove the if statement to prevent hard fault to occur.
Signed-off-by: Michal Lenc <michallenc@seznam.cz>
nxspawn_open() is expected to return "OK" when it success, but
it doesn't return it in case of executing dup2.
Because of this, the "Command as parameter" couldn't work with
Builtin Apps.
include/nuttx/wqueue.h:
libs/libc/wqueue/work_cancel.c:
libs/libc/wqueue/work_queue.c:
sched/wqueue/kwork_cancel.c:
sched/wqueue/kwork_queue.c:
* Fix spelling, grammar, and typos.
* Improve wording in a few areas.
* These changes affect comments only. No functional changes.
and change the default value of IDLETHREAD_STACKSIZE to 65536
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Change-Id: Ia54efbbca4b69706150bc4178844b316688a104e
Note: all attributes is guarded by PSEUDOFS_ATTRIBUTES to save the space
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Change-Id: I664d60382e356068fd920f08aca5b4a49d8d92a9
MIRTOS-109
Return error when tv_nsec <0 or >=1000 million.
Change-Id: Iddbbcda163cb402551f619efb7486f6798859d57
Signed-off-by: Peter Bee <bijunda1@xiaomi.com>
Fail case:
exit -> nxtask_terminate -> nxtask_exithook -> nxsched_release_tcb
group_leave || nxsched_releasepid & group_leave
/\
/ \
switch out & waitpid()
Thread A group_leave in nxtask_exithook, switch out,
Thread B do waitpid(thread A) then meet traget thread A group is NULL, error.
Change-Id: Ia181d7a13aa645ec1c3141a45839fbf79db35b17
Signed-off-by: ligd <liguiding1@xiaomi.com>
